# Entitlement tables for row-level security

*Tableau Consultant Study Guide · Plan and Prepare Data Connections · Last updated November 3, 2026 · https://www.certifyforce.com/study-guide/tableau-consultant/plan-and-prepare-data-connections/entitlement-tables-for-row-level-security*

Model entitlement tables for row-level security: deepest-granularity versus sparse entitlements, roles mapped to users, cross joins for NULL means all, the All Access group override, join-then-filter row explosion, two-object extracts, and the published data source filter that keeps it secure.

- Certification: Salesforce Tableau Consultant
- Exam section: Plan and Prepare Data Connections
- Study guide: https://www.certifyforce.com/study-guide/tableau-consultant

**Official exam objective:**

> Implement RLS and an entitlement table.

## What the exam expects

- Design an entitlement table: username column, one row per most granular entitlement, roles mapped to users, denormalized into one view.
- Choose between full mapping to the deepest granularity and sparse entitlements, and join each correctly.
- Explain row explosion in live queries and single-table extracts, and recommend the two-object Physical Tables extract.
- Secure the result with a published data source filter and the capabilities that must be denied.
- Match entitlement usernames to the site, including email-address usernames on Tableau Cloud.

Key terms:
- **Entitlement:** any unique combination of attributes the data can be filtered on.
- **Entitlements view:** entitlements mapped to users or roles, denormalized into one table, view or query.
- **Sparse entitlements:** entitlements defined per hierarchy level, with NULL meaning "all".
- **Data source filter:** a filter stored on the data source, acting as a WHERE clause for every query.
- **Multi-table extract:** an extract stored as Physical Tables, keeping the join out of the stored rows.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Embedded data source with RLS | Filters can be removed by web editing or downloading | [RLS best practices](https://help.tableau.com/current/server/en-us/rls_bestpractices.htm) |
| Deny on workbooks | Web Edit, Download/Save a copy, Set Permissions | [Create a user filter](https://help.tableau.com/current/pro/desktop/en-us/publish_userfilters_create.htm) |
| Deny on data sources | Save, Download, Set Permissions | [Create a user filter](https://help.tableau.com/current/pro/desktop/en-us/publish_userfilters_create.htm) |
| Full mapping | One row per possible entitlement; fewer join clauses | [RLS best practices](https://help.tableau.com/current/server/en-us/rls_bestpractices.htm) |
| Sparse entitlements | NULL means "all"; more complex joins and filters | [RLS best practices](https://help.tableau.com/current/server/en-us/rls_bestpractices.htm) |
| Join then filter | Rows processed up to entitled users × data rows | [RLS best practices](https://help.tableau.com/current/server/en-us/rls_bestpractices.htm) |
| Multi-table extracts | Since 2018.3; two objects; extract filters disabled | [RLS best practices](https://help.tableau.com/current/server/en-us/rls_bestpractices.htm) |
| RLS with extracts | Requires multiple physical tables | [User filters and RLS](https://help.tableau.com/current/pro/desktop/en-us/publish_userfilters.htm) |
| Tableau Cloud username | A unique email address | [Database RLS](https://help.tableau.com/current/server/en-us/rls_datasource.htm) |
| Filter as User preview | Not available with a published data source | [Create a user filter](https://help.tableau.com/current/pro/desktop/en-us/publish_userfilters_create.htm) |

## Check yourself

- What does the RLS workflow require so that each signed-in user can be identified?
- Why is the initial "blowup" of a denormalized entitlements view acceptable?
- Why does Tableau recommend limiting an RLS extract to a data table and a reference table?
- Which Tableau version first let the data engine build multi-table extracts for RLS?

## Sources

- [RLS Best Practices for Data Sources and Workbooks](https://help.tableau.com/current/server/en-us/rls_bestpractices.htm)
- [Overview of Row-Level Security Options in Tableau](https://help.tableau.com/current/server/en-us/rls_options_overview.htm)
- [Restrict Data Access with User Filters and Row Level Security](https://help.tableau.com/current/pro/desktop/en-us/publish_userfilters.htm)
- [Create a User Filter and Secure it for Publishing](https://help.tableau.com/current/pro/desktop/en-us/publish_userfilters_create.htm)
- [Row-Level Security in the Database](https://help.tableau.com/current/server/en-us/rls_datasource.htm)
- [Extract Your Data](https://help.tableau.com/current/pro/desktop/en-us/extracting_data.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the Tableau Consultant pack (USD $19): https://www.certifyforce.com/practice-exams